fix(privacy): anchor the remaining tracking SDK patterns

[Maher-Reven]

Stacked on #33. This branch contains that commit as its base, so the diff here shows two commits — review the second one, or merge #33 first and this will reduce to it. Opened separately because the two changes are independently reviewable.

Problem

#33 fixes google.*ads matching loadSdk. The rest of the table has the same shape, and one of them is worse than the reported case.

An unanchored .* between two short tokens matches across unrelated code on the same line:

pattern	ordinary code that trips it	reported as
adjust.*sdk	label.adjustsFontSizeToFitWidth = true // call before sdkInit()	Adjust SDK
adjust.*sdk	scrollView.adjustedContentInset = insets; let sdkReady = true	Adjust SDK
unity.*ads	unityWebView.loadThreads();	Unity Ads
unity.*ads	const unityBridge = init(); const uploads = [];	Unity Ads
google.*analytics	{ googleClientId: ID, analyticsEnabled: false }	Google Analytics
firebase.*analytics	import { getAuth } from 'firebase/auth'; // analytics intentionally omitted	Firebase Analytics
facebook.*sdk	// the facebook login flow was removed; see sdkMigration.md	Facebook SDK

adjust.*sdk is the one I would prioritise. adjustsFontSizeToFitWidth and adjustedContentInset are ordinary UIKit that appear in most iOS codebases, so the trigger is just "this file also contains the letters sdk" — and like #30 it produces a CRITICAL §5.1.2 that fails --exit-code.

Fix

Require a distinctive token in each case rather than two fragments with a gap:

{regexp.MustCompile(`(?i)(firebaseanalytics|firebase[-/]analytics)`), "Firebase Analytics"},
{regexp.MustCompile(`(?i)(googleanalytics|google-analytics)`), "Google Analytics"},
{regexp.MustCompile(`(?i)(fbsdk|facebooksdk|facebook-sdk)`), "Facebook SDK"},
{regexp.MustCompile(`(?i)(adjust[-_]?sdk|react-native-adjust|com\.adjust\b|Adjust\.(appDidLaunch|trackEvent|initSdk|getAdid))`), "Adjust SDK"},
{regexp.MustCompile(`(?i)(unityads|unity-ads|unity3d\.ads)`), "Unity Ads"},

Adjust keeps its API call sites in the alternation because the iOS SDK is imported as AdjustSdk but used as Adjust.appDidLaunch(...), and a file may contain only the latter.

Two alternations are also collapsed because (?i) already makes their branches identical: (applovin|AppLovinSDK) → applovin, (ironSource|IronSource) → ironsource.

What I deliberately did not change

mixpanel, appsflyer, amplitude, @segment/ and branch.io are left as they are. The issue on #30 suggested mixpanel might have the same problem — it does not. It is a distinctive brand token that cannot appear inside an ordinary identifier the way ads appears inside loadSdk. Changing it would be churn.

(Those patterns do still match inside comments and string literals, but that is a property of how the scan is run rather than of the patterns, and it is not in scope here.)

Testing

Both directions, in internal/privacy/scanner_test.go:

• TestTrackingPatternsIgnoreOrdinaryCode — the seven rows in the table above. All seven fail against the old patterns; I verified by reverting them.
• TestTrackingPatternsStillDetectRealSDKs — twelve real integrations that must keep matching, covering both the import form and the API-call form for Adjust, plus Unity Ads, Google Analytics, Firebase Analytics (RN and Swift), Facebook SDK (RN and iOS), AppLovin and ironSource.

go build ./... and go test ./... are clean.

---

Note

Medium Risk
Changes compliance scan heuristics; anchored patterns could miss uncommon SDK spellings, though broad positive/negative tests reduce that risk.

Overview
Tightens tracking/ad SDK detection in the privacy scanner so loose token.*token regexes stop firing on unrelated same-line code (e.g. UIKit adjustsFontSizeToFitWidth + sdk, googleClientId + analyticsEnabled, firebase/auth comments). That class of matches was incorrectly raising CRITICAL §5.1.2 “tracking SDK without ATT” and failing --exit-code.

Patterns for Firebase/Google Analytics, Facebook, Adjust, Google Ads/AdMob, Unity Ads, AppLovin, and ironSource now match distinctive package/API tokens (imports, RN package names, Adjust.* call sites, Firebase compat paths, etc.) instead of unanchored gaps. AppLovin/ironSource alternations are simplified under (?i).

Adds scanner_test.go coverage in both directions: ordinary code must not report those SDKs, and representative real integrations must still be detected (including AdMob cases from #30).

^{Reviewed by Cursor Bugbot for commit ab79e2e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 9666c1b. Configure here.}